GlobalProtect VPN flaw fuels Qilin and INC ransomware attacks, Palo Alto warns

Palo Alto Networks says ransomware operators are continuing to exploit a previously patched GlobalProtect VPN vulnerability to enter corporate networks, bypass multi-factor authentication and reach systems beyond the VPN gateway.

In an October 19 update to its Unit 42 threat brief, the company identified activity involving Qilin and INC ransomware operators. It expanded the brief again on October 20 with guidance on checking for accidentally exposed management interfaces. This article was published on October 21, 2026; the underlying vulnerability was disclosed in May, not this week.

The new warning matters because it describes what attackers are doing after gaining access. In one investigation, Unit 42 found a route from a compromised VPN gateway to the infrastructure that runs an organization’s virtual machines, allowing attackers to extract credentials outside the reach of security software inside those machines.

An authentication shortcut becomes an entry point

The vulnerability, CVE-2026-0257, affects authentication in the GlobalProtect portal and gateway components of PAN-OS, Palo Alto Networks’ firewall operating system. The advisory also lists affected Prisma Access releases. It rates the issue high severity, with a CVSS version 4.0 base score of 7.8.

Exposure depends on configuration, not simply on having a Palo Alto firewall. The vendor says the issue affects GlobalProtect portals or gateways with authentication override cookies enabled and a specific certificate configuration. These cookies let a service remember a previous authentication rather than requiring a fresh sign-in every time.

An attacker who exploits the weakness can establish an unauthorized VPN connection. Unit 42 says the ransomware activity uses that access to bypass multi-factor authentication, or MFA. This is a failure in the vulnerable authentication path, not evidence that MFA is generally ineffective or should be switched off.

Palo Alto Networks first published its advisory on May 13. Unit 42 says the flaw entered the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog that day. The October development is continued ransomware exploitation and more detail about its consequences, rather than a newly discovered zero-day.

Attackers move beyond the VPN gateway

Unit 42 attributes observed exploitation to Spikey Scorpius, its name for Qilin, and Tarnished Scorpius, associated with INC. The researchers separately acknowledge public reporting linking the flaw to attackers using Settra ransomware; that attribution should not be confused with their own directly described observations.

After establishing VPN sessions, attackers have used remote monitoring and management tools to examine internal networks. Such tools have legitimate administrative uses but can also help intruders operate inside a victim’s environment. The researchers describe movement between machines using Remote Desktop Protocol and Server Message Block, followed by preparation for credential theft, data exfiltration and ransomware deployment.

The most consequential example involved VMware infrastructure. Unit 42 says attackers moved from the compromised gateway to a vCenter management appliance, disabled the execInstalledOnly security control on ESXi hypervisors, and used a custom tool to extract credentials from a domain controller’s virtual disk while it was offline.

A hypervisor runs virtual machines; a domain controller manages authentication in a Windows domain. Reading its virtual disk from the infrastructure layer can bypass endpoint detection and response software running inside the guest operating system. Unit 42 described this as a way to obtain domain-wide credentials. It did not say every attack followed that route.

The investigations also found attempts to exploit Veeam backup infrastructure through the older CVE-2023-27532 vulnerability. That makes checking the VPN gateway alone insufficient when there are signs an attacker has already connected.

What administrators should check now

Organizations should compare their exact PAN-OS or Prisma Access release with the vendor’s product-status and solution tables, then move to an appropriate fixed version. Different release branches have different hotfix thresholds; a single version number is not a reliable instruction for every deployment.

The advisory says all GlobalProtect portals and gateways that generate or accept authentication override cookies should be upgraded, including internal and external components. Hybrid Prisma Access environments also need their on-premises firewalls addressed. Users may have to authenticate again after the upgrade because the fix changes how override cookies are generated.

Where immediate upgrading is not possible, Palo Alto Networks describes two mitigations: disable authentication override, or generate a new certificate used exclusively for authentication override cookies. Reusing a portal or gateway certificate is not the recommended mitigation. A certificate previously used for other functions should not simply be repurposed.

Patching should be accompanied by investigation. Unit 42 recommends examining GlobalProtect logs for successful gateway-connected events associated with its published indicators and activating incident response when suspicious successful connections are found. Administrators should review the live indicator list and its time context rather than assume a short historical IP list captures every current attacker.

The October 20 addition also warns that mapping GlobalProtect profiles to HTTP or HTTPS services on management interfaces can unintentionally expose management access, notably on ports 4443 and 3879. The researchers recommend checking exposure externally and restricting access using the official interface-management guidance. This is a separate configuration check, not a substitute for fixing CVE-2026-0257.

What this means for remote workers

This warning concerns enterprise remote-access infrastructure, not a demonstrated flaw in every consumer VPN service. Employees generally cannot patch the company gateway themselves: they should follow their IT team’s upgrade and reauthentication instructions and report unexpected access problems through established support channels.

For organizations, the practical distinction is between preventing another unauthorized connection and determining whether one has already happened. A fixed gateway addresses the vulnerable entry point; it does not establish that credentials, virtual infrastructure or backups remain untouched. The latest findings make that second question just as important as the patch itself.